Symantec, makers of Norton software, told Motherboard that it found another 13,000 computers with the malicious software update utility. However, Kaspersky is not the only security outfit to trace the malware samples back to Asus. The company says one of the reasons it was able to go undetected all of this time is because the Trojanized updates were signed with legitimate security certificates from Asus, and were hosted on Asus's official update servers.Īsus denied this when contacted by Kaspersky in January, telling the company that its servers were not compromised and that it had not hosted any malware.

Kaspersky discovered the 'sophisticated supply chain attack' in January of this year and found links to an attack from 2017. Of course, there might be other samples out there with different MAC addresses in their list,' Kaspersky added. We were able to extract more than 600 unique MAC addresses from over 200 samples used in this attack. 'The goal of the attack was to surgically target an unknown pool of users, which were identified by their network adapters’ MAC addresses. 'We are not able to calculate the total count of affected users based only on our data however, we estimate that the real scale of the problem is much bigger and is possibly affecting over a million users worldwide,' Kaspersky said.ĭubbed 'Operation Shadowhammer,' the culprits may not have actually been targeting millions of users, but a comparatively select few. After Vice Motherboard ran a story on Kaspersky's findings, the security firm clarified a few details in a blog post, saying that over 57,000 users of its antivirus software have downloaded and installed the compromised version of Live Update at some point in time. It might not be as safe as we assumed, however. Using Live Update is a convenient way to stay updated, and until now, has been considered safe. It comes preinstalled on many Asus-brand laptops and desktops, and is offered as a standalone download for the company's millions of motherboards. Live Update is a utility that allows Asus to push out driver, software, and firmware updates to PCs. By their nature, backdoors are vulnerabilities that attackers can exploit, if they know about them. In security parlance, a backdoor is a way for an administrator to gain access to a system or data through a generally undocumented means. Lest anyone need reminding of this, security firm Kaspersky dropped a bombshell on Monday, saying hackers were able to install backdoors on tens of thousands of PCs-and maybe even millions of systems-by pushing out firmware updates through Asus's own Live Update software. When it comes to PCs, true security is a myth. It's encouraging all users of Asus hardware to run it as a precaution. Finally, Asus released a security diagnostic tool to check if your system is affected.

What is asus live update utility